LUCAMEMicrosoft has announced new security features aimed at managing the risks posed by AI agents running inside business software. As these agents increasingly take autonomous actions, such as reading emails, browsing files, or triggering workflows, they create a new category of insider risk that existing controls were not designed to handle. The new capabilities, arriving in Microsoft 365 E7 and a product called Project Perception, are intended to monitor agent behaviour and adjust protections automatically. Microsoft is treating AI agents as a distinct class of user that requires its own security policy.
What this means for your business
If your business uses Microsoft 365 and is starting to adopt Copilot or other AI agents, those agents can access sensitive data in much the same way a member of staff can. You should ask your IT provider to review what permissions your agents have been granted and whether audit logging covers their activity. The ICO expects organisations to remain in control of how personal data is processed, so automated agents acting on that data without proper oversight could create a compliance problem under UK GDPR.